[G2 and Desire Z Q&A, Help & Troubleshooting] rondald:
Hello guys, i wanted to reply to thread http://xdaforums.com/showthread.php?t=1492461 but sadly forum doesnt let me due to insuficient rights (i think you need 10 posts to post in developer forums), so here is my analysis on Phone Encryption feature based on jerl92`s current CM9-vision-RC2 ROM. So feel free to move my posting whereever you feel it belongs to...

Also forum rules seem to force me to formulate a question of of this (lol), so here is my question:

Q: How to get Phone encryption running STABLE on a DesireZ aka vision device using command line vdc, or get it running anway using GUI?

A: Partially and unstable i was able to get it working using jerl92's CM9-vision-RC2 ROM : Please read below...

I wasnt able to get phone encryption working on ROMs based on newer Android codebase, but I was able to successfully encrypt a HTC vision device (Desire Z) using the following procedure for Phone Encryption with CM9-vision-RC2 ROM (which sidesteps the filesystemsizeproblem described below, FORMATS /data partition and leads in case of CM9-vision-RC2.zip to a HIGHLY unstable system afterwards):

adb shell

su

vdc cryptfs enablecrypto wipe yourpass

* The system will freeze for a few seconds (follow adb logcat), reboots and then comes up with a password prompt.

* Phone encryption password is yourpass

* After having arrived back at home screen, the device reboots after 2minutes without any indication in logcat. So you only have roughly 2 minutes time for debugging *g*.

* BUT AT LEAST ENCRYPTION WORKS AND ROM DEVELOPMENT CAN GO ON: adb shell mount | grep /data

/dev/block/dm-0 /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered,noauto_da_alloc 0 0

*vdc cryptfs cryptocomplete: 200 0

*vdc cryptfs verifypw yourpass: 200 0

*vdc cryptfs verifypw wrongpass: 200 1

I am sure jerl92 can identify the reason for those reboot loops in the logcat of such encrypted CM9-vision-RC2 system and its just one or more of the hacks at systemstart which he already applied to normal system and need to be repeated after START {cmp=com.android.settings/.CryptKeeper$Blank} in logcat! :)

My configuration:

* ROM: CM9-vision-RC2

* hboot-eng.img: vision.hboot-0.84.2000

* TRUE RADIO S-OFF: Despite the knowledge about different partition layouts throughout different Radio firmwares it does NOT seem to be important which Radio version is currently on the phone: I tested below's procedure with Vision_Radio_12.62.60.27_26.13.04.19, as well as with Vision_Radio_12.57.60.25_26.10.04.12-PC10IMG and Vision_Radio_12.62.60.27_26.13.04.19(From T_MOBLIE OTA 2.16.531.5, and there doesnt seem a difference in behavior).

Then I was able to identify at least 2 problems with (i think all) jerl92's ROMs using normal phone encryption using Settings | Security | Encrypt phone:

1) The /data filesystem has the wrong size (fitting mmcblk0p26 100%, which is 16 Kbytes too large)

2) There is another issue at around 50% of encryption progress. My only idea is that there is a problem encrypting the sdcard, based on logcat showing several timeouts in the mounting procedure while the encryption progress is running.

Workaround for 1):

For better understanding please read: https://source.android.com/tech/encryption/android_crypto_implementation.html

immediately after having tapped on Settings | Security | Encrypt phone, and initiating the encryption process, adb logcat shows:

D/VoldCmdListener( ): cryptfs enablecrypto inplace {}

E/Cryptfs ( ): Orig filesystem overlaps crypto footer region. Cannot encrypt in place.

(you can tap back-button to go back)

The short term solution for that error is described at https://code.google.com/p/cyanogenmod/issues/detail?id=5678#c21, and also comment #46: #c46

But use your own /data partition which is in case of HTC vision mmcblk0p26: adb shell mount | grep /data

/dev/block/mmcblk0p26 /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered,noauto_da_alloc 0 0

Following format command worked for me inside recovery using CWM after having mounted /system: /system/xbin/mkfs.ext2 -l 1143979008 /dev/block/mmcblk0p26

(alternative command mounting /data shortly to test size using df, and 1099608-16=1099592: mke2fs /dev/block/mmcblk0p26 1099592)

@jerl92: Long term solution I think should be modification of fstab (like https://android.googlesource.com/device/moto/wingray/+/android-4.1.1_r2/recovery.fstab ) as described in second part of https://jira.cyanogenmod.org/browse...issuetabpanels:comment-tabpanel#comment-10700.

Ideas on 2):

logcat is full with "W/MountService( ): Waiting too long for mReady!" during the regular GUI encryption process.

and also showing up with

"D/VoldCmdListener( ): volume mount /mnt/sdcard

W/VoldConnector( ): Unhandled event '612 Volume sdcard /mnt/sdcard mount failed - no media'

E/MountService( ): Boot-time mount failed (-2)

"

Probably there is an issue starting encryption of sdcard at 50% of total encryption progress (as part of the implementation described on http://source.android.com/tech/encryption/android_crypto_implementation.html).

And no, my microSDcard is inserted; i even made sure NOT to have special cards inserted like a goldcard, which i initially thought of the problem could be... :D

Other ideas to get the /data partition on vision devices encrypted

*Modified CWM as described here http://xdaforums.com/showthread.php?t=1167089 for another device

*Using an old way initially designed for wildfire but it might also work on vision devices: https://github.com/guardianproject/luksunlock I wasnt able to compile using current toolchain for ICS and higher :-/

* Adopting the issue to CM10.1 and helping to develop/debug following idea: https://code.google.com/p/cyanogenmod/issues/detail?id=5678#c34, currently migrated to https://jira.cyanogenmod.org/browse/CYAN-87 (maybe someone tells Flinny for his ROMs): In which ROM does these changes flow to, so one can test them on vision devices?

So how do you guys think is the cheapest and fastest way to get our devices encrypted?

I cant "cook", nor do i know how to apply patches / modify to already existing ROMs using recovery update :-/